On Mon, Jul 13, 2026 at 05:23:42PM +0900, Daehyeon Ko wrote:

Clear sock->sk on the failed-insert path so the existing tipc_release()
NULL check fires and the use-after-free is avoided.

The fix itself looks right: clearing sock->sk on the failed-insert path
is what __sock_create() expects from pf->create() on failure, and it
mirrors the same dangling-sk fix done for AF_SMC in commit d293958a8595
("net/smc: do not leave a dangling sk pointer in __smc_create()").

Reviewed-by: Breno Leitao <leitao@debian.org>

Fixes: 07f6c4bc048a ("tipc: convert tipc reference table to use generic rhashtable")

Is 07f6c4bc048a the commit that actually introduced this? Or the
sk_free() that got added by commit 00aff3590fc0a ("net: tipc: fix
possible refcount leak in tipc_sk_create()") ?